security: clear the frontend runtime advisories - #67
Merged
Conversation
npm audit --omit=dev has been failing on eleven high-severity advisories since they were published, which blocks the release gate added in #56. Three chains were involved and none of them were fixable by a plain version bump. @opennextjs/cloudflare is only used by next.config.ts, open-next.config.ts and the build scripts; nothing under src imports it. Moving it to devDependencies is what it always should have been, and it takes the wrangler → miniflare → sharp and @opennextjs/aws → @node-minify → glob → minimatch → brace-expansion chains out of the runtime graph with it. postcss stays reachable through next, which pins 8.4.31, so no next release fixes it. The existing postcss override is moved from the now-vulnerable 8.5.13 to ^8.5.23, and sharp is pinned the same way. Both are patch-level moves within the major the packages already depend on. next goes to 16.2.12, which is also what @opennextjs/cloudflare's peer range asks for; on 16.2.10 npm could not resolve the tree at all. Verified with the gate's own command: community, member and frontend all exit zero, and the frontend still type-checks, tests, lints and builds. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
npm audit --omit=devが11件の high で失敗し続けており、#56 で追加されたリリースゲートを塞いでいます。develop 単体で再現します(このPRとは独立に、アドバイザリ公開以降ずっと赤)。単純なバージョン更新では直りません
3つの連鎖があり、いずれもバージョンを上げるだけでは解消しませんでした。
npm audit fix --forceはnext@9.3.3へのダウングレードを提案してきます。@opennextjs/cloudflare→ wrangler → miniflare → sharp@opennextjs/cloudflare→ @opennextjs/aws → @node-minify/core → glob → minimatchnext→ postcss(16.2.12 でも 8.4.31 を固定)対処
1.
@opennextjs/cloudflareを devDependencies へnext.config.ts/open-next.config.tsとビルドスクリプトからのみ使われ、src/配下は一切 import していません。元々 devDependencies が正しい分類で、移動により上位2つの連鎖が実行時グラフから外れます。wranglerは既に devDependencies にあり、この1つが橋渡しになっていました。2.
overridesで postcss と sharp を修正版に固定postcss は next 経由で残り、next はどのリリースでも 8.4.31 を固定するため上流の更新を待っても直りません。既存の override が
8.5.13(現在は脆弱)だったので^8.5.23に更新し、sharp も同様に固定しました。いずれもパッケージが既に依存しているメジャー内のパッチ移動です。3.
nextを 16.2.12 へ@opennextjs/cloudflareの peer 範囲(>=16.2.11)を満たします。16.2.10 のままだと npm が依存ツリーを解決できませんでした。検証
ゲートと同じコマンドで確認しています。
npm audit --omit=dev --audit-level=highfrontend は型チェック・テスト・lint(エラー0)・本番ビルドも通ります。
補足
実行時グラフから外しただけで、ビルドツール側の脆弱性が消えたわけではありません。ただし
--omit=devはデプロイされるコードの依存を対象にするゲートであり、ビルド専用ツールをそこに含めていたのが本来の誤りです。ビルドツールの更新は通常の依存更新として別途扱えます。🤖 Generated with Claude Code